Commit Graph

76 Commits

Author SHA1 Message Date
Takashi Iwai
bfc81a8bc1 ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
When a USB-audio device receives a maliciously adjusted or corrupted
buffer descriptor, the USB-audio driver may access an out-of-bounce
value at its parser.  This was detected by syzkaller, something like:

  BUG: KASAN: slab-out-of-bounds in usb_audio_probe+0x27b2/0x2ab0
  Read of size 1 at addr ffff88006b83a9e8 by task kworker/0:1/24
  CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc1-42251-gebb2c2437d80 #224
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  Workqueue: usb_hub_wq hub_event
  Call Trace:
   __dump_stack lib/dump_stack.c:16
   dump_stack+0x292/0x395 lib/dump_stack.c:52
   print_address_description+0x78/0x280 mm/kasan/report.c:252
   kasan_report_error mm/kasan/report.c:351
   kasan_report+0x22f/0x340 mm/kasan/report.c:409
   __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427
   snd_usb_create_streams sound/usb/card.c:248
   usb_audio_probe+0x27b2/0x2ab0 sound/usb/card.c:605
   usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
   really_probe drivers/base/dd.c:413
   driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
   __device_attach_driver+0x230/0x290 drivers/base/dd.c:653
   bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
   __device_attach+0x26e/0x3d0 drivers/base/dd.c:710
   device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
   bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
   device_add+0xd0b/0x1660 drivers/base/core.c:1835
   usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
   generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
   usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
   really_probe drivers/base/dd.c:413
   driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
   __device_attach_driver+0x230/0x290 drivers/base/dd.c:653
   bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
   __device_attach+0x26e/0x3d0 drivers/base/dd.c:710
   device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
   bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
   device_add+0xd0b/0x1660 drivers/base/core.c:1835
   usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
   hub_port_connect drivers/usb/core/hub.c:4903
   hub_port_connect_change drivers/usb/core/hub.c:5009
   port_event drivers/usb/core/hub.c:5115
   hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
   process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
   worker_thread+0x221/0x1850 kernel/workqueue.c:2253
   kthread+0x3a1/0x470 kernel/kthread.c:231
   ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431

This patch adds the checks of out-of-bounce accesses at appropriate
places and bails out when it goes out of the given buffer.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-09-22 16:21:31 +02:00
Arvind Yadav
8824ae2de8 ALSA: usb-audio: constify usb_device_id.
usb_device_id are not supposed to change at runtime. All functions
working with usb_device_id provided by <linux/usb.h> work with
const usb_device_id. So mark the non-const structs as const.

Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-08-06 22:20:10 +02:00
Takashi Iwai
03a1f48e53 ALSA: usb-audio: Fake also USB device id when alias is given
Recently snd-usb-audio driver received a new option, quirk_alias, to
allow user to apply the existing quirk for a different device.  This
works for many quirks as is, but some still need more tune-ups:
namely, some quirks check the USB vendor/device IDs in various places,
thus it doesn't work as long as the ID is different from the expected
one.

With this patch, the driver stores the aliased USB ID, so that these
rest quirks per device ID are applied.  The transition to use the
cached USB ID was already done in the past, so what we needed now is
only to overwrite chip->usb_id.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2017-03-31 11:19:19 +02:00
Takashi Iwai
4763601a56 ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream()
The function returns -EINVAL even if it builds the stream properly.
The bogus error code sneaked in during the code refactoring, but it
wasn't noticed until now since the returned error code itself is
ignored in anyway.  Kill it here, but there is no behavior change by
this patch, obviously.

Fixes: e5779998bf ('ALSA: usb-audio: refactor code')
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-11-29 22:28:40 +01:00
Takashi Iwai
6ff1a25318 ALSA: usb-audio: Fix use-after-free of usb_device at disconnect
The usb-audio driver implements the deferred device disconnection for
the device in use.  In this mode, the disconnection callback returns
immediately while the actual ALSA card object removal happens later
when all files get closed.  As Shuah reported, this code flow,
however, leads to a use-after-free, detected by KASAN:

 BUG: KASAN: use-after-free in snd_usb_audio_free+0x134/0x160 [snd_usb_audio] at addr ffff8801c863ce10
 Write of size 8 by task pulseaudio/2244
 Call Trace:
  [<ffffffff81b31473>] dump_stack+0x67/0x94
  [<ffffffff81564ef1>] kasan_object_err+0x21/0x70
  [<ffffffff8156518a>] kasan_report_error+0x1fa/0x4e0
  [<ffffffff81564ad7>] ? kasan_slab_free+0x87/0xb0
  [<ffffffff81565733>] __asan_report_store8_noabort+0x43/0x50
  [<ffffffffa0fc0f54>] ? snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0f54>] snd_usb_audio_free+0x134/0x160 [snd_usb_audio]
  [<ffffffffa0fc0fb1>] snd_usb_audio_dev_free+0x31/0x40 [snd_usb_audio]
  [<ffffffff8243c78a>] __snd_device_free+0x12a/0x210
  [<ffffffff8243d1f5>] snd_device_free_all+0x85/0xd0
  [<ffffffff8242cae4>] release_card_device+0x34/0x130
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  [<ffffffff81b37ad7>] kobject_release+0x107/0x370
  .....
 Object at ffff8801c863cc80, in cache kmalloc-2048 size: 2048
 Allocated:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff8156450d>] kasan_kmalloc+0xad/0xe0
  [<ffffffff81560d1a>] kmem_cache_alloc_trace+0xfa/0x240
  [<ffffffff8214ea47>] usb_alloc_dev+0x57/0xc90
  [<ffffffff8216349d>] hub_event+0xf1d/0x35f0
  ....
 Freed:
  [<ffffffff810804eb>] save_stack_trace+0x2b/0x50
  [<ffffffff81564296>] save_stack+0x46/0xd0
  [<ffffffff81564ac1>] kasan_slab_free+0x71/0xb0
  [<ffffffff81560929>] kfree+0xd9/0x280
  [<ffffffff8214de6e>] usb_release_dev+0xde/0x110
  [<ffffffff81ef1846>] device_release+0x76/0x1e0
  ....

It's the code trying to clear drvdata of the assigned usb_device where
the usb_device itself was already released in usb_release_dev() after
the disconnect callback.

This patch fixes it by checking whether the code path is via the
disconnect callback, i.e. chip->shutdown flag is set.

Fixes: 79289e2419 ('ALSA: usb-audio: Refer to chip->usb_id for quirks...')
Reported-and-tested-by: Shuah Khan <shuahkh@osg.samsung.com>
Cc: <stable@vger.kernel.org> # v4.6+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-11-14 22:05:04 +01:00
Kazuki Oikawa
76df529697 ALSA: usb-audio: Fix quirks code is not called
snd_usb_{set_interface,ctl_msg}_quirk checks chip->usb_id to need
calling a quirks code. But existed code path that not calling
dev_set_drvdata in usb_audio_probe.

Fixes: 79289e2419 ("ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation")
Signed-off-by: Kazuki Oikawa <k@oikw.org>
Cc: <stable@vger.kernel.org> # v4.6+
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Tested-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-07-18 12:32:45 +02:00
Takashi Iwai
2e00fde5c6 Merge branch 'for-linus' into for-next 2016-05-10 16:06:04 +02:00
Oliver Neukum
748a1ccc43 ALSA: usb-audio: correct speed checking
Allow handling SS+ USB devices correctly.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-05-08 11:42:04 +02:00
Mauro Carvalho Chehab
c89178f57a [media] Revert "[media] sound/usb: Use Media Controller API to share media resources"
Unfortunately, this patch caused several regressions at au0828 and
snd-usb-audio, like this one:
	https://bugzilla.kernel.org/show_bug.cgi?id=115561

It also showed several troubles at the MC core that handles pretty
poorly the memory protections and data lifetime management.

So, better to revert it and fix the core before reapplying this
change.

This reverts commit aebb2b89bf ("[media] sound/usb: Use Media
Controller API to share media resources")'

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-03-31 15:02:33 -03:00
Linus Torvalds
021f163d69 sound updates for 4.6-rc1
After a heavy storm by syzkaller in 4.5 cycle, we have relatively few
 changes in the core at this time while a lot of changes are found in
 the driver side, unsurprisingly.  Below are some highlights:
 
 ALSA core:
 - A few more hardening in ALSA timer codes
 - An extension of sequencer API for advertising the card / pid
 - Small fixes in compress-offload and jack layers
 
 HD-audio:
 - Dynamic PCM assignment in HDMI/DP codec; preparation for upcoming
   DP-MST support
 - Lots of code refactoring for sharing with ASoC SKL driver
 - Regression fixes for Intel HDMI/DP
 - Fixups for CX20724 codec, Lenovo AiO
 
 USB-audio:
 - Add quirk_alias option to make quirk debugging easier
 - Fixes for possible Oops by malformed firmware
 
 Firewire:
 - Add support for FW-1804 in tascam driver
 - Improvements / changes in card registration, multi stream handling,
   etc for DICE
 - Lots of code refactoring
 
 ASoC:
 - Enhancements of still ongoing topology API
 - Lots of commits for Intel Skylake support including HDMI support
 - A few Intel Atom driver updates for recent devices
 - Lots of improvements to the Renesas drivers
 - Capture support for Qualcomm drivers
 - Support for TI DaVinci DRA7xxx devices
 - New machine drivers for Freescale systems with Cirrus CODECs,
   Mediatek systems with RT5650 CODECs
 - New CPU drivers for Allwinner S/PDIF controllers
 - New CODEC drivers for Maxim MAX9867 and MAX98926 and Realtek RT5514
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2
 
 iQIcBAABCAAGBQJW69UAAAoJEGwxgFQ9KSmkoaAQAJ6uBco1gqTmYkJGyLMRRblT
 BxEQ0NMSlPrNEJpR6GOYknrdPZiA4WfxT1zhswDQoNvSKery3bn3aOGfWHA9I+9j
 TRUwHkOAlRCcwgTfy70pRS0fcAx34y9nTcAWsVn9RbrMP3ydkwKyMXRqTwqYr5u5
 UU53PSdwhUO8q/PomvBeip8nvw7zrV+06nVbEMUnIQlgp165n/qq0sRFBVkRBBJ7
 ooqe6VW6F2Es3Zh+W9Vp/qn9OpZEdDCKvmICX1RIFJUgYRRxbL+L021TGjkaXVmT
 Or9L9StRYePZsCo1I1vsYUbYc6+Y3qDmqViGhREHBZ27EY8G1Utk7wy959vt0eFj
 1xHynw36kmjrw/QlPraJBRuYIQh4SRAcXhw+wQdM5rxdp7gDjikhkezHZQWrvQAJ
 5XXitZhVVNa9DRS5ZRwnW5nT/emQ+KBuJyl9gyAL1HaoZoYnDvRkfe9CGpgj7TRP
 wYcnL+rKL9x8eiJY5VTfL9rIxTgNYXvuPPBgdmJEp8qu5de8O1g5UN0xHSGf3yhr
 DVE5r/2J+gYNprsSF9DV6pfFQuh/Efw9XW2IbK6k6WF4labWGeD7rLrI4t9aJcXv
 PJ1FY/sUFhHZhZjHlGbR9emK+BLtZweFvOAvY7dD74ON65D5tYXvHPo0QTc4V5Op
 d0eDg0pcTdFLDqq8ZLLr
 =Cc+v
 -----END PGP SIGNATURE-----

Merge tag 'sound-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound updates from Takashi Iwai:
 "After a heavy storm by syzkaller in 4.5 cycle, we have relatively few
  changes in the core at this time while a lot of changes are found in
  the driver side, unsurprisingly.  Below are some highlights:

  ALSA core:
   - A few more hardening in ALSA timer codes
   - An extension of sequencer API for advertising the card / pid
   - Small fixes in compress-offload and jack layers

  HD-audio:
   - Dynamic PCM assignment in HDMI/DP codec; preparation for upcoming
     DP-MST support
   - Lots of code refactoring for sharing with ASoC SKL driver
   - Regression fixes for Intel HDMI/DP
   - Fixups for CX20724 codec, Lenovo AiO

  USB-audio:
   - Add quirk_alias option to make quirk debugging easier
   - Fixes for possible Oops by malformed firmware

  Firewire:
   - Add support for FW-1804 in tascam driver
   - Improvements / changes in card registration, multi stream handling,
     etc for DICE
   - Lots of code refactoring

  ASoC:
   - Enhancements of still ongoing topology API
   - Lots of commits for Intel Skylake support including HDMI support
   - A few Intel Atom driver updates for recent devices
   - Lots of improvements to the Renesas drivers
   - Capture support for Qualcomm drivers
   - Support for TI DaVinci DRA7xxx devices
   - New machine drivers for Freescale systems with Cirrus CODECs,
     Mediatek systems with RT5650 CODECs
   - New CPU drivers for Allwinner S/PDIF controllers
   - New CODEC drivers for Maxim MAX9867 and MAX98926 and Realtek RT5514"

* tag 'sound-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (291 commits)
  ALSA: hda - Fix mutex deadlock at HDMI/DP hotplug
  ALSA: ctl: change return value in compatibility layer so that it's the same value in core implementation
  ALSA: mixart: silence an uninitialized variable warning
  ALSA: usb-audio: Add sanity checks for endpoint accesses
  ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()
  ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
  ALSA: hda - Limit i915 HDMI binding only for HSW and later
  ALSA: hda - Fix unconditional GPIO toggle via automute
  ALSA: mixart: silence unitialized variable warnings
  ALSA: hda - Fixes double fault in nvhdmi_chmap_cea_alloc_validate_get_type
  ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.
  ALSA: hda - Add new GPU codec ID 0x10de0082 to snd-hda
  ASoC: rsnd: add simplified module explanation
  ASoC: hdac_hdmi: Add broxton device ID
  ASoC: Intel: Bxtn: Add Broxton PCI ID
  ASoC: Intel: Skylake: Move Skylake dsp ops & loader ops
  ASoC: Intel: add dmabuffer to common sst_dsp
  ASoC: Intel: Skylake: Unstatify skl_dsp_enable_core
  ASoC: Intel: Skylake: Fix whitepsace issues
  ASoC: Intel: Skylake: Move module id defines
  ...
2016-03-18 10:05:46 -07:00
Shuah Khan
aebb2b89bf [media] sound/usb: Use Media Controller API to share media resources
Change ALSA driver to use Media Controller API to share media resources
with DVB and V4L2 drivers on a AU0828 media device. Media Controller
specific initialization is done after sound card is registered. ALSA
creates Media interface and entity function graph nodes for Control,
Mixer, PCM Playback, and PCM Capture devices.

snd_usb_hw_params() will call Media Controller enable source handler
interface to request the media resource. If resource request is
granted, it will release it from snd_usb_hw_free(). If resource is
busy, -EBUSY is returned.

Media specific cleanup is done in usb_audio_disconnect().

Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
2016-03-03 15:01:13 -03:00
Takashi Iwai
e270336331 ALSA: usb-audio: Add quirk_alias option
This patch adds a new option "quirk_alias" to snd-usb-audio driver for
allowing user to pass the quirk alias list.  A quirk alias consists of
a string form like 0123abcd:5678beef, which makes to apply a quirk to
a device with USB ID 0123:abcd treated as if it were 5678:beef.
This feature is useful to test an existing quirk, typically for a
newer model of the same vendor, without patching / rebuilding the
kernel driver.

The current implementation is fairly simplistic: since there is no API
for matching a usb_device_id to the given ID pair, it has an open code
to loop over the id table and matches only with vendor:product pair.
So far, this is OK, as all existing entries are with vendor:product
pairs, indeed.  Once when we have another matching entry, however,
we'd need to update get_alias_quirk() as well.

Note that this option is provided only for testing / development.  If
you want to have a proper support, contact to upstream for adding the
matching quirk in the driver code statically.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-01-29 07:36:10 +01:00
Takashi Iwai
79289e2419 ALSA: usb-audio: Refer to chip->usb_id for quirks and MIDI creation
This is a preliminary patch for the later change to allow a better
quirk ID management.  In the current USB-audio code, there are a few
places looking at usb_device idVendor and idProduct fields directly
even though we have already a static member in snd_usb_audio.usb_id.
This patch modifies such codes to refer to the latter field.

For achieving this, two slightly intensive changes have been done:
- The snd_usb_audio object is set/reset via dev_getdrv() for the given
  USB device; it's needed for minimizing the changes for some existing
  quirks that take only usb_device object.

- __snd_usbmidi_create() is introduced to receive the pre-given usb_id
  argument.  The exported snd_usbmidi_create() is unchanged by calling
  this new function internally.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-01-29 07:36:10 +01:00
Takashi Iwai
5c06d68bc2 ALSA: usb-audio: Avoid calling usb_autopm_put_interface() at disconnect
ALSA PCM may still have a leftover instance after disconnection and
it delays its release.  The problem is that the PCM close code path of
USB-audio driver has a call of snd_usb_autosuspend().  This involves
with the call of usb_autopm_put_interface() and it may lead to a
kernel Oops due to the NULL object like:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000190
 IP: [<ffffffff815ae7ef>] usb_autopm_put_interface+0xf/0x30 PGD 0
 Call Trace:
  [<ffffffff8173bd94>] snd_usb_autosuspend+0x14/0x20
  [<ffffffff817461bc>] snd_usb_pcm_close.isra.14+0x5c/0x90
  [<ffffffff8174621f>] snd_usb_playback_close+0xf/0x20
  [<ffffffff816ef58a>] snd_pcm_release_substream.part.36+0x3a/0x90
  [<ffffffff816ef6b3>] snd_pcm_release+0xa3/0xb0
  [<ffffffff816debb0>] snd_disconnect_release+0xd0/0xe0
  [<ffffffff8114d417>] __fput+0x97/0x1d0
  [<ffffffff8114d589>] ____fput+0x9/0x10
  [<ffffffff8109e452>] task_work_run+0x72/0x90
  [<ffffffff81088510>] do_exit+0x280/0xa80
  [<ffffffff8108996a>] do_group_exit+0x3a/0xa0
  [<ffffffff8109261f>] get_signal+0x1df/0x540
  [<ffffffff81040903>] do_signal+0x23/0x620
  [<ffffffff8114c128>] ? do_readv_writev+0x128/0x200
  [<ffffffff810012e1>] prepare_exit_to_usermode+0x91/0xd0
  [<ffffffff810013ba>] syscall_return_slowpath+0x9a/0x120
  [<ffffffff817587cd>] ? __sys_recvmsg+0x5d/0x70
  [<ffffffff810d2765>] ? ktime_get_ts64+0x45/0xe0
  [<ffffffff8115dea0>] ? SyS_poll+0x60/0xf0
  [<ffffffff818d2327>] int_ret_from_sys_call+0x25/0x8f

We have already a check of disconnection in snd_usb_autoresume(), but
the check is missing its counterpart.  The fix is just to put the same
check in snd_usb_autosuspend(), too.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=109431
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2016-01-12 14:12:38 +01:00
Takashi Iwai
0662292aec ALSA: usb-audio: Handle normal and auto-suspend equally
In theory, the device may get suspended even at runtime PM suspend.
Currently we don't save the mixer state for autopm, and it may bring
inconsistency.

This patch removes the special handling for autosuspend.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-08-26 16:12:25 +02:00
Takashi Iwai
a6da499b76 ALSA: usb-audio: Replace probing flag with active refcount
We can use active refcount for preventing autopm during probe.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-08-26 15:40:18 +02:00
Takashi Iwai
47ab154593 ALSA: usb-audio: Avoid nested autoresume calls
After the recent fix of runtime PM for USB-audio driver, we got a
lockdep warning like:

  =============================================
  [ INFO: possible recursive locking detected ]
  4.2.0-rc8+ #61 Not tainted
  ---------------------------------------------
  pulseaudio/980 is trying to acquire lock:
   (&chip->shutdown_rwsem){.+.+.+}, at: [<ffffffffa0355dac>] snd_usb_autoresume+0x1d/0x52 [snd_usb_audio]
  but task is already holding lock:
   (&chip->shutdown_rwsem){.+.+.+}, at: [<ffffffffa0355dac>] snd_usb_autoresume+0x1d/0x52 [snd_usb_audio]

This comes from snd_usb_autoresume() invoking down_read() and it's
used in a nested way.  Although it's basically safe, per se (as these
are read locks), it's better to reduce such spurious warnings.

The read lock is needed to guarantee the execution of "shutdown"
(cleanup at disconnection) task after all concurrent tasks are
finished.  This can be implemented in another better way.

Also, the current check of chip->in_pm isn't good enough for
protecting the racy execution of multiple auto-resumes.

This patch rewrites the logic of snd_usb_autoresume() & co; namely,
- The recursive call of autopm is avoided by the new refcount,
  chip->active.  The chip->in_pm flag is removed accordingly.
- Instead of rwsem, another refcount, chip->usage_count, is introduced
  for tracking the period to delay the shutdown procedure.  At
  the last clear of this refcount, wake_up() to the shutdown waiter is
  called.
- The shutdown flag is replaced with shutdown atomic count; this is
  for reducing the lock.
- Two new helpers are introduced to simplify the management of these
  refcounts; snd_usb_lock_shutdown() increases the usage_count, checks
  the shutdown state, and does autoresume.  snd_usb_unlock_shutdown()
  does the opposite.  Most of mixer and other codes just need this,
  and simply returns an error if it receives an error from lock.

Fixes: 9003ebb13f ('ALSA: usb-audio: Fix runtime PM unbalance')
Reported-and-tested-by: Alexnader Kuleshov <kuleshovmail@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-08-26 15:38:25 +02:00
Takashi Iwai
9003ebb13f ALSA: usb-audio: Fix runtime PM unbalance
The fix for deadlock in PM in commit [1ee23fe07e: ALSA: usb-audio:
Fix deadlocks at resuming] introduced a new check of in_pm flag.
However, the brainless patch author evaluated it in a wrong way
(logical AND instead of logical OR), thus usb_autopm_get_interface()
is wrongly called at probing, leading to unbalance of runtime PM
refcount.

This patch fixes it by correcting the logic.

Reported-by: Hans Yang <hansy@nvidia.com>
Fixes: 1ee23fe07e ('ALSA: usb-audio: Fix deadlocks at resuming')
Cc: <stable@vger.kernel.org> [v3.15+]
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2015-08-19 14:57:51 +02:00
Takashi Iwai
19566b0bd9 Merge branch 'for-linus' into for-next
This merges the USB-audio disconnect fix and resolves the conflicts
so that we can continue working on development of usb-audio stuff.

Conflicts:
	sound/usb/card.c
2014-11-05 15:37:22 +01:00
Takashi Iwai
0725dda207 ALSA: usb-audio: Fix device_del() sysfs warnings at disconnect
Some USB-audio devices show weird sysfs warnings at disconnecting the
devices, e.g.
 usb 1-3: USB disconnect, device number 3
 ------------[ cut here ]------------
 WARNING: CPU: 0 PID: 973 at fs/sysfs/group.c:216 device_del+0x39/0x180()
 sysfs group ffffffff8183df40 not found for kobject 'midiC1D0'
 Call Trace:
  [<ffffffff814a3e38>] ? dump_stack+0x49/0x71
  [<ffffffff8103cb72>] ? warn_slowpath_common+0x82/0xb0
  [<ffffffff8103cc55>] ? warn_slowpath_fmt+0x45/0x50
  [<ffffffff813521e9>] ? device_del+0x39/0x180
  [<ffffffff81352339>] ? device_unregister+0x9/0x20
  [<ffffffff81352384>] ? device_destroy+0x34/0x40
  [<ffffffffa00ba29f>] ? snd_unregister_device+0x7f/0xd0 [snd]
  [<ffffffffa025124e>] ? snd_rawmidi_dev_disconnect+0xce/0x100 [snd_rawmidi]
  [<ffffffffa00c0192>] ? snd_device_disconnect+0x62/0x90 [snd]
  [<ffffffffa00c025c>] ? snd_device_disconnect_all+0x3c/0x60 [snd]
  [<ffffffffa00bb574>] ? snd_card_disconnect+0x124/0x1a0 [snd]
  [<ffffffffa02e54e8>] ? usb_audio_disconnect+0x88/0x1c0 [snd_usb_audio]
  [<ffffffffa015260e>] ? usb_unbind_interface+0x5e/0x1b0 [usbcore]
  [<ffffffff813553e9>] ? __device_release_driver+0x79/0xf0
  [<ffffffff81355485>] ? device_release_driver+0x25/0x40
  [<ffffffff81354e11>] ? bus_remove_device+0xf1/0x130
  [<ffffffff813522b9>] ? device_del+0x109/0x180
  [<ffffffffa01501d5>] ? usb_disable_device+0x95/0x1f0 [usbcore]
  [<ffffffffa014634f>] ? usb_disconnect+0x8f/0x190 [usbcore]
  [<ffffffffa0149179>] ? hub_thread+0x539/0x13a0 [usbcore]
  [<ffffffff810669f5>] ? sched_clock_local+0x15/0x80
  [<ffffffff81066c98>] ? sched_clock_cpu+0xb8/0xd0
  [<ffffffff81070730>] ? bit_waitqueue+0xb0/0xb0
  [<ffffffffa0148c40>] ? usb_port_resume+0x430/0x430 [usbcore]
  [<ffffffffa0148c40>] ? usb_port_resume+0x430/0x430 [usbcore]
  [<ffffffff8105973e>] ? kthread+0xce/0xf0
  [<ffffffff81059670>] ? kthread_create_on_node+0x1c0/0x1c0
  [<ffffffff814a8b7c>] ? ret_from_fork+0x7c/0xb0
  [<ffffffff81059670>] ? kthread_create_on_node+0x1c0/0x1c0
 ---[ end trace 40b1928d1136b91e ]---

This comes from the fact that usb-audio driver may receive the
disconnect callback multiple times, per each usb interface.  When a
device has both audio and midi interfaces, it gets called twice, and
currently the driver tries to release resources at the last call.
At this point, the first parent interface has been already deleted,
thus deleting a child of the first parent hits such a warning.

For fixing this problem, we need to call snd_card_disconnect() and
cancel pending operations at the very first disconnect while the
release of the whole objects waits until the last disconnect call.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=80931
Reported-and-tested-by: Tomas Gayoso <tgayoso@gmail.com>
Reported-and-tested-by: Chris J Arges <chris.j.arges@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-11-05 15:36:25 +01:00
Takashi Iwai
ae366c2049 ALSA: usb-audio: Use strim() instead of open code
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-11-04 15:09:13 +01:00
Takashi Iwai
a6cece9d81 ALSA: usb-audio: Pass direct struct pointer instead of list_head
Some functions in mixer.c and endpoint.c receive list_head instead of
the object itself.  This is not obvious and rather error-prone.  Let's
pass the proper object directly instead.

The functions in midi.c still receive list_head and this can't be
changed since the object definition isn't exposed to the outside of
midi.c, so left as is.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-11-04 15:09:10 +01:00
Takashi Iwai
4c8c3a4fcc ALSA: usb-audio: Flatten probe and disconnect functions
The usb-audio probe and disconnect functions have been split just for
adapting the (new!) API at 2.5 kernel time.  We left them until now,
partly because we wanted to build with the pretty old kernels in the
external alsa-driver tree.  But the support of such old kernels has
been longly stopped, so it's good time to clean up this mess.

One good point by this cleanup is that now the probe function returns
a proper error code instead of only -EIO.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-11-04 15:09:08 +01:00
Adam Goode
f7881e5e8e ALSA: usb-audio: Respond to suspend and resume callbacks for MIDI input
sound/usb/card.c registers USB suspend and resume but did not previously
kill the input URBs. This means that USB MIDI devices left open across
suspend/resume had non-functional input (output still usually worked,
but it looks like that is another issue). Before this change, we would
get ESHUTDOWN for each of the input URBs at suspend time, killing input.

Signed-off-by: Adam Goode <agoode@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-08-05 20:08:00 +02:00
Takashi Iwai
92a586bdc0 ALSA: usb-audio: Fix races at disconnection and PCM closing
When a USB-audio device is disconnected while PCM is still running, we
still see some race: the disconnect callback calls
snd_usb_endpoint_free() that calls release_urbs() and then kfree()
while a PCM stream would be closed at the same time and calls
stop_endpoints() that leads to wait_clear_urbs().  That is, the EP
object might be deallocated while a PCM stream is syncing with
wait_clear_urbs() with the same EP.

Basically calling multiple wait_clear_urbs() would work fine, also
calling wait_clear_urbs() and release_urbs() would work, too, as
wait_clear_urbs() just reads some fields in ep.  The problem is the
succeeding kfree() in snd_pcm_endpoint_free().

This patch moves out the EP deallocation into the later point, the
destructor callback.  At this stage, all PCMs must have been already
closed, so it's safe to free the objects.

Reported-by: Alan Stern <stern@rowland.harvard.edu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-06-26 10:33:35 +02:00
Takashi Iwai
1ee23fe07e ALSA: usb-audio: Fix deadlocks at resuming
The recent addition of the USB audio mixer suspend/resume may lead to
deadlocks when the driver tries to call usb_autopm_get_interface()
recursively, since the function tries to sync with the finish of the
other calls.  For avoiding it, introduce a flag indicating the resume
operation and avoids the recursive usb_autopm_get_interface() calls
during the resume.

Reported-and-tested-by: Bryan Quigley <gquigs@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-05-02 18:17:06 +02:00
Takashi Iwai
1c53e7253e ALSA: usb-audio: Save mixer status only once at suspend
The suspend callback of usb-audio driver may be called multiple times
per suspend when multiple USB interfaces are bound to a single sound
card instance.  In such a case, it's superfluous to save the mixer
values multiple times.  This patch fixes it by checking the counter.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-05-02 18:14:42 +02:00
Takashi Iwai
0ba41d917e ALSA: usb-audio: Use standard printk helpers
Convert with dev_err() and co from snd_printk(), etc.
As there are too deep indirections (e.g. ep->chip->dev->dev),
a few new local macros, usb_audio_err() & co, are introduced.

Also, the device numbers in some messages are dropped, as they are
shown in the prefix automatically.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-02-26 16:45:34 +01:00
Takashi Iwai
874b8d422e ALSA: usb: Convert to snd_card_new() with a device pointer
Also remove superfluous snd_card_set_dev() calls.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-02-12 11:18:00 +01:00
Takashi Iwai
400362f1d8 ALSA: usb-audio: Resume mixer values properly
Implement reset_resume callback so that the mixer values are properly
restored.  Still no boot quirks are called, so it might not work well
on some devices.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2014-02-03 09:51:34 +01:00
Sachin Kamat
6b5a7c66ce ALSA: usb-audio: Use module_usb_driver
module_usb_driver makes code simpler by removing the boilerplate.

Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-10-09 14:00:34 +02:00
Thomas Pugliese
df3774c5c5 ALSA: usb-audio: add support for wireless USB devices
This patch updates snd_usb_audio_create also support devices whose
speed == USB_SPEED_WIRELESS.

Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-10-07 12:51:54 +02:00
Alan Stern
976b6c064a ALSA: improve buffer size computations for USB PCM audio
This patch changes the way URBs are allocated and their sizes are
determined for PCM playback in the snd-usb-audio driver.  Currently
the driver allocates too few URBs for endpoints that don't use
implicit sync, making underruns more likely to occur.  This may be a
holdover from before I/O delays could be measured accurately; in any
case, it is no longer necessary.

The patch allocates as many URBs as possible, subject to four
limitations:

	The total number of URBs for the endpoint is not allowed to
	exceed MAX_URBS (which the patch increases from 8 to 12).

	The total number of packets per URB is not allowed to exceed
	MAX_PACKS (or MAX_PACKS_HS for high-speed devices), which is
	decreased from 20 to 6.

	The total duration of queued data is not allowed to exceed
	MAX_QUEUE, which is decreased from 24 ms to 18 ms.

	The total number of ALSA frames in the output queue is not
	allowed to exceed the ALSA buffer size.

The last requirement is the hardest to implement.  Currently the
number of URBs needed to fill a buffer cannot be determined in
advance, because a buffer contains a fixed number of frames whereas
the number of frames in an URB varies to match shifts in the device's
clock rate.  To solve this problem, the patch changes the logic for
deciding how many packets an URB should contain.  Rather than using as
many as possible without exceeding an ALSA period boundary, now the
driver uses only as many packets as needed to transfer a predetermined
number of frames.  As a result, unless the device's clock has an
exceedingly variable rate, the number of URBs making up each period
(and hence each buffer) will remain constant.

The overall effect of the patch is that playback works better in
low-latency settings.  The user can still specify values for
frames/period and periods/buffer that exceed the capabilities of the
hardware, of course.  But for values that are within those
capabilities, the performance will be improved.  For example, testing
shows that a high-speed device can handle 32 frames/period and 3
periods/buffer at 48 KHz, whereas the current driver starts to get
glitchy at 64 frames/period and 2 periods/buffer.

A side effect of these changes is that the "nrpacks" module parameter
is no longer used.  The patch removes it.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Clemens Ladisch <clemens@ladisch.de>
Tested-by: Daniel Mack <zonque@gmail.com>
Tested-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-09-26 10:25:31 +02:00
Clemens Ladisch
342cda2934 ALSA: usb-audio: work around Android accessory firmware bug
When the Android firmware enables the audio interfaces in accessory
mode, it always declares in the control interface's baInterfaceNr array
that interfaces 0 and 1 belong to the audio function.  However, the
accessory interface itself, if also enabled, already is at index 0 and
shifts the actual audio interface numbers to 1 and 2, which prevents the
PCM streaming interface from being seen by the host driver.

To get the PCM interface interface to work, detect when the descriptors
point to the (for this driver useless) accessory interface, and redirect
to the correct one.

Reported-by: Jeremy Rosen <jeremy.rosen@openwide.fr>
Tested-by: Jeremy Rosen <jeremy.rosen@openwide.fr>
Cc: <stable@vger.kernel.org>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-06-17 09:56:52 +02:00
Takashi Iwai
60af3d037e ALSA: usb-audio: Fix autopm error during probing
We've got strange errors in get_ctl_value() in mixer.c during
probing, e.g. on Hercules RMX2 DJ Controller:

  ALSA mixer.c:352 cannot get ctl value: req = 0x83, wValue = 0x201, wIndex = 0xa00, type = 4
  ALSA mixer.c:352 cannot get ctl value: req = 0x83, wValue = 0x200, wIndex = 0xa00, type = 4
  ....

It turned out that the culprit is autopm: snd_usb_autoresume() returns
-ENODEV when called during card->probing = 1.

Since the call itself during card->probing = 1 is valid, let's fix the
return value of snd_usb_autoresume() as success.

Reported-and-tested-by: Daniel Schürmann <daschuer@mixxx.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-04-25 07:46:51 +02:00
Eldad Zack
ef02e29b01 ALSA: usb-audio: UAC2: auto clock selection module param
Add a module param to disable auto clock selection.
This is provided for users that expect the audio stream to
fail when the clock source is invalid (e.g., the word clock
was unintentionally disconnected).

Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-04-04 08:31:32 +02:00
Eldad Zack
f9d3543591 ALSA: usb-audio: neaten MODULE_DEVICE_TABLE placement
Minor style fix, following a general code style in the kernel.

Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-04-04 08:30:18 +02:00
Eldad Zack
88766f04c4 ALSA: usb-audio: convert list_for_each to entry variant
Change occurances of list_for_each into list_for_each_entry where
applicable.

Signed-off-by: Eldad Zack <eldad@fogrefinery.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-04-04 08:30:06 +02:00
Clemens Ladisch
281a6ac0f5 ALSA: usb-audio: add a workaround for the NuForce UDH-100
The NuForce UDH-100 numbers its interfaces incorrectly, which makes the
interface associations come out wrong, which results in the driver
erroring out with the message "Audio class v2 interfaces need an
interface association".

Work around this by searching for the interface association descriptor
also in some other place where it might have ended up.

Reported-and-tested-by: Dave Helstroom <helstroom@google.com>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-03-12 08:35:30 +01:00
Antonio Ospite
aa53f98674 ALSA: usb: cosmetics, remove a leading space
Signed-off-by: Antonio Ospite <ao2@amarulasolutions.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2013-01-29 15:11:13 +01:00
Takashi Iwai
20d32022a8 ALSA: usb-audio: Deprecate async_unlink option
The async unlink behavior has been working over years.  The option was
provided only as a workaround for 2.4.x kernel.  Let's get rid of it.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-11-21 11:37:40 +01:00
Takashi Iwai
10e44239f6 ALSA: usb-audio: Fix mutex deadlock at disconnection
The recent change for USB-audio disconnection race fixes introduced a
mutex deadlock again.  There is a circular dependency between
chip->shutdown_rwsem and pcm->open_mutex, depicted like below, when a
device is opened during the disconnection operation:

A. snd_usb_audio_disconnect() ->
     card.c::register_mutex ->
       chip->shutdown_rwsem (write) ->
         snd_card_disconnect() ->
           pcm.c::register_mutex ->
             pcm->open_mutex

B. snd_pcm_open() ->
     pcm->open_mutex ->
       snd_usb_pcm_open() ->
         chip->shutdown_rwsem (read)

Since the chip->shutdown_rwsem protection in the case A is required
only for turning on the chip->shutdown flag and it doesn't have to be
taken for the whole operation, we can reduce its window in
snd_usb_audio_disconnect().

Reported-by: Jiri Slaby <jslaby@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-11-14 15:29:09 +01:00
Takashi Iwai
34f3c89fda ALSA: usb-audio: Use rwsem for disconnect protection
Replace mutex with rwsem for codec->shutdown protection so that
concurrent accesses are allowed.

Also add the protection to snd_usb_autosuspend() and
snd_usb_autoresume(), too.

Reported-by: Matthieu CASTET <matthieu.castet@parrot.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-10-30 11:07:00 +01:00
Takashi Iwai
384dc085c3 ALSA: usb-audio: Avoid unnecessary EP setups in prepare
The recent fix for USB suspend breakage moved the code to set up EP
from hw_params to prepare, but it means also the EP setup might be
called multiple times unnecessarily because the prepare callback can
be called multiple times without starting the stream (e.g. OSS
emulation).

This patch adds a new flag to struct snd_usb_substream indicating
whether the setup of EP is required, and do it only when necessary,
i.e. right after hw_params or suspend.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-09-19 08:08:16 +02:00
Pavel Roskin
03d2f44e96 ALSA: snd-usb: use list_for_each_safe for endpoint resources
snd_usb_endpoint_free() frees the structure that contains its argument.

Signed-off-by: Pavel Roskin <proski@gnu.org>
Cc: stable@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-08-31 18:17:45 +02:00
Daniel Mack
edcd3633e7 ALSA: snd-usb: switch over to new endpoint streaming logic
With the previous commit that added the new streaming model, all
endpoint and streaming related code is now in endpoint.c, and pcm.c
only acts as a wrapper for handling the packet's payload.

Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-04-13 10:24:08 +02:00
Daniel Mack
596580d0ee ALSA: snd-usb: add snd_usb_audio-wide mutex
This is needed for new card-wide list operations.

Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2012-04-13 10:21:55 +02:00
Rusty Russell
a67ff6a540 ALSA: module_param: make bool parameters really bool
module_param(bool) used to counter-intuitively take an int.  In
fddd5201 (mid-2009) we allowed bool or int/unsigned int using a messy
trick.

It's time to remove the int/unsigned int option.  For this version
it'll simply give a warning, but it'll break next kernel version.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2011-12-19 10:34:41 +01:00
Paul Gortmaker
da155d5b40 sound: Add module.h to the previously silent sound users
Lots of sound drivers were getting module.h via the implicit presence
of it in <linux/device.h> but we are going to clean that up.  So
fix up those users now.

Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2011-10-31 19:31:21 -04:00
Linus Torvalds
68d99b2c8e Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (549 commits)
  ALSA: hda - Fix ADC input-amp handling for Cx20549 codec
  ALSA: hda - Keep EAPD turned on for old Conexant chips
  ALSA: hda/realtek - Fix missing volume controls with ALC260
  ASoC: wm8940: Properly set codec->dapm.bias_level
  ALSA: hda - Fix pin-config for ASUS W90V
  ALSA: hda - Fix surround/CLFE headphone and speaker pins order
  ALSA: hda - Fix typo
  ALSA: Update the sound git tree URL
  ALSA: HDA: Add new revision for ALC662
  ASoC: max98095: Convert codec->hw_write to snd_soc_write
  ASoC: keep pointer to resource so it can be freed
  ASoC: sgtl5000: Fix wrong mask in some snd_soc_update_bits calls
  ASoC: wm8996: Fix wrong mask for setting WM8996_AIF_CLOCKING_2
  ASoC: da7210: Add support for line out and DAC
  ASoC: da7210: Add support for DAPM
  ALSA: hda/realtek - Fix DAC assignments of multiple speakers
  ASoC: Use SGTL5000_LINREG_VDDD_MASK instead of hardcoded mask value
  ASoC: Set sgtl5000->ldo in ldo_regulator_register
  ASoC: wm8996: Use SND_SOC_DAPM_AIF_OUT for AIF2 Capture
  ASoC: wm8994: Use SND_SOC_DAPM_AIF_OUT for AIF3 Capture
  ...
2011-10-28 14:25:01 -07:00